5 ms·
Could it have been on an exchange or something that used his number for 2FA? I’m not sure how else a SIM swap could lead to access.
by nerdawson 5y ago
Could it have been on an exchange or something that used his number for 2FA? I’m not sure how else a SIM swap could lead to access.
- miohtama 5y agoYes. Likely Coinbase. SIM swap is such a well known attack vector, so it is pure stupidy to leave such high amount behind an SMS.
- AlexCoventry 5y agoSeems kind of crazy to leave that amount on an exchange at all.
- amatecha 5y agoYeah like, this happened years after the mtgox debacle...
- Jerrrry 5y agoIt was a major exchange that did not understand what the 2 in "2FA" meant, yes. Most exchanges did not have proper 2FA until the sim-swath-swoop of 2018-2020.
- nerdawson 5y agoI hate when companies ask for my phone number on sign up. At no point do I ever want that used for auth! The first thing I usually do is enable OTP but I know some companies will still fallback to SMS.
- miohtama 5y agoAll major exchanges have supported TOTP (time codes) based 2FA since 2014. However it is a different matter if they force users to use TOTP, as it hinders adoption. Need to get that IPO done first.
- ziddoap 5y agoYes, I should have been more accurate and said "accessible by phone", not necessarily stored on the phone. One would think with any significant amount of crypto that you store it somewhere non-network accessible (at the very least, not holding it all in a single online exchange).